Close the last four headers, and say what the destructive tools refuse to do

Tools/conf_container_prune.sh

@@ -23,6 +23,7 @@
 #       rsync would then stop nothing before copying a live database. They are excluded by name and
 #       must stay excluded.
 #
+# OPERATIONAL SAFEGUARDS
 #   A docker that cannot be read is not a docker with nothing in it.
 #       If `docker ps -a` fails, times out, or returns nothing on a host that is meant to run
 #       containers, EVERY name looks missing and one run would strike the entire configuration.
@@ -34,7 +35,24 @@
 #       verified by sourcing the result in a subshell and confirming the key still parses as an
 #       array with exactly one fewer element.
 #
-# USAGE
+#   Each removal is its own verified rewrite.
+#       Several names can reach the limit in one run, and each is removed and re-verified
+#       independently rather than batched into a single edit. A rewrite that fails verification
+#       therefore costs that one entry, not every entry the run intended to prune.
+#
+#   --dry-run records no strike. A dry run that advanced the counter would eventually prune
+#   through repetition alone, which is the opposite of what it is for.
+#
+# CONFIGURATION
+#   master.conf
+#     CONF_PRUNE_STRIKE_LIMIT   consecutive runs a name must be missing before it is removed.
+#                               Seeing the container again resets its strike to zero immediately,
+#                               so a rebuild costs one strike at most.
+#
+#   The keys this may prune are an explicit allow list in the script, deliberately not a conf
+#   value — see DESIGN PRINCIPLES for why a pattern is the wrong shape here.
+#
+# RUNTIME MODES
 #   conf_container_prune.sh              strike, and prune anything at the limit
 #   conf_container_prune.sh --dry-run    report what would be struck and pruned, write nothing
 #   conf_container_prune.sh --status     show current strikes and stop